We live in an age in which information and data defines us as people. For example, banking data defines our finances and tracks our assets, while government data tracks our tax information, our driver license, our court records, and so forth. Credit cards enable shopping online and at physical stores. Information about our health is stored by doctors, hospitals and pharmacies. Information supplements our communication, enabling sharing of voice, video and pictures. This seamless flow of information improves our lifestyle, creating a convenient environment to live and work.
However, this information should not be globally accessible, and in many cases, such information is unknowingly or illegitimately acquired or stolen. Information leaks (also known as information disclosure) are a key issue when using technology. Information leaks can result through several mechanisms, and can be either intentional or unintentional. Such examples include user action, in which a user inputs information to an application through a human-computer interface such as a keyboard. In addition, techniques such as social engineering may trick users into leaking information. In some cases, even legitimate applications access a user's information and leak this information, or use the information to create a digital “footprint” of the user. For example, in some cases, the user is not allowed to use an application until the user discloses personal information such as the user's current location. Or, the application may not operate properly unless the user provides such information to the application. In addition, malware or attack software can access information and then leak it, and many of these types of attacks go undetected by the user, and some sophisticated attacks may even go undetected by the operating system and anti-virus software. Additionally, computing device infections often occur when users browse the Internet to untrusted web sites or when they download or open untrusted network resources such as applications and documents. These infections allow attackers to steal the user's credentials or even take control of the computing device to repurpose it for the attacker's own means.
While one solution to combat these information attacks is to shut down network access to the computing device, this severely limits the functionality of many modern computing devices. Additionally, in a workplace environment, disabling network access hampers employee productivity and job satisfaction. As a compromise, many employers enable limited network access by preventing employees from accessing untrusted network resources. However, this limited network access results in increased administration costs for the employer as the employer must consistently update policy defining which network resources are untrusted. This can lead to frustration with the use of computing devices by both the users and the employer. Further, many legitimate applications which users would like to utilize on a regular basis may still access personal or sensitive information, and it can be difficult, therefore, to limit use of every type of application with network access.